StepLeague Privacy Policy

Flashsoft ("we," "us," or "our") operates the StepLeague mobile application (the "App"). This Privacy Policy explains what information the App collects, how we use it, who we share it with, and the choices you have.

By using StepLeague, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Health & Fitness Data (via Apple HealthKit)

With your permission, StepLeague reads the following from Apple Health:

• Daily step count
• Flights of stairs climbed

We request this access via the system HealthKit permission prompt. You can review or revoke this access at any time in iPhone Settings → Privacy & Security → Health → StepLeague.

HealthKit data is used solely to power the App's core features — your step ring, streaks, achievements, and leaderboards. In accordance with Apple's Developer Program requirements:

• We do not sell, rent, or otherwise disclose HealthKit data to third parties, advertisers, or data brokers.
• We do not use HealthKit data for advertising, marketing, or other use-based data mining purposes unrelated to health or fitness.
• Aggregated step/floor totals are synced to our backend (Supabase, see §3) only so leaderboards and friend comparisons can work; they are shown to other users only as your leaderboard rank and step count, consistent with your privacy settings (see §6, Private Mode).

1.2 Location Data

With your permission, StepLeague uses your approximate ("when in use") location to determine your city and country, which are used to place you in the correct city/country leaderboard scopes. We do not collect precise GPS location history, and we do not track your location in the background.

1.3 Account & Profile Information

• Display name and friend code, shown to other users on leaderboards and in friend lists.
• City and country, used for leaderboard scoping (see §1.2).
• A unique user ID generated by our authentication provider.
• If you sign in with Sign in with Apple, we receive the identifier and, depending on the choice you make at sign-in, either your real email address or an Apple-generated private relay address. We never see your Apple ID password.

1.4 Camera

StepLeague requests camera access only to let you scan a friend's QR code to add them faster. Camera frames are processed on-device to read the QR code and are never recorded, stored, or transmitted.

1.5 Motion & Fitness Activity

StepLeague checks recent walking activity via Apple's Motion & Fitness framework as an integrity check, to help keep leaderboards fair. This data is processed on-device and is not stored on our servers as raw motion data.

1.6 Purchases & Subscriptions

If you purchase a StepLeague Pro subscription, the transaction is handled entirely by Apple's App Store / StoreKit. We do not receive or store your payment card details. We receive confirmation of your subscription status from our subscription-management partner, Apphud, so the App can unlock Pro features.

1.7 Push Notifications

If you allow notifications, we use your device's push token to send reminders (e.g. streak reminders, weekly summaries, friend activity). You can disable notifications at any time in iPhone Settings.

1.8 App Tracking Transparency & Advertising Identifier

StepLeague will ask for your permission, via Apple's App Tracking Transparency (ATT) framework, before accessing your device's advertising identifier (IDFA). If you grant permission, the IDFA and your device's vendor identifier (IDFV) are shared with our subscription/analytics partner, Apphud, to help us understand app performance. You may grant or deny this permission at the system prompt, and may change your choice at any time in iPhone Settings → Privacy & Security → Tracking.

1.9 Usage & Diagnostic Data

We automatically collect certain technical and usage information via analytics SDKs (see §3) — such as which screens you visit, which features you use, app version, device model, and crash/error logs — to help us fix bugs and improve the App.

1.10 Content You Provide

If you contact support or use the in-app contact form, we collect the information you provide (e.g. your message and, if given, your email address) solely to respond to your request.

2. How We Use Information

We use the information above to:

• Provide and operate the App's core features (step tracking, streaks, achievements, leaderboards, friends, journeys/milestones)
• Authenticate your account and sync your data across your devices
• Detect and prevent cheating, abuse, and policy violations
• Process and validate subscription purchases
• Send you notifications you've opted into
• Diagnose crashes and improve the App's performance and stability
• Respond to support requests
• Comply with legal obligations

We do not use your Health data, location, or camera access for advertising.

3. Third-Party Services

StepLeague relies on the following third-party services to operate. Each processes a subset of the data described above, subject to their own privacy policies:

Service: Purpose

Supabase: Backend database, authentication, friend/leaderboard storage

Apple Sign in with Apple: Authentication

Apphud: Subscription management, receipt validation

Amplitude: Product analytics

Firebase (Google): Analytics and crash diagnostics

Apple StoreKit: In-app purchases

We do not sell your personal information to third parties.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account (see §6), we delete your profile, steps, streaks, achievements, friend connections, and friend code from our servers. Some anonymized or aggregated analytics data, which cannot reasonably be linked back to you, may be retained for longer for product-improvement purposes.

5. Data Storage & Security

Your account data is stored with Supabase, using row-level security policies so that only you (and, where you've explicitly connected as friends, your friends, subject to your privacy settings) can access your data. We take reasonable technical and organizational measures to protect your information, but no method of transmission or storage is 100% secure.

6. Your Choices & Rights

• Private Mode: You can limit what other users see about your activity in the App's settings.
• Revoke permissions: You can revoke Health, Location, Camera, Motion, Notifications, and Tracking permissions at any time in iPhone Settings.
• Access & correction: You can view and edit your profile information (display name, city, country, goals) directly in the App.
• Delete your account: You can permanently delete your account and all associated data at any time from Settings → Delete Account. This immediately and irreversibly removes your profile, steps, streak, achievements, friends, and friend code from our servers.
• Restore purchases: Managed entirely through your Apple ID; see Apple's own subscription-management tools.

To exercise any other privacy right, or if you have questions about this policy, contact us at the address in §10.

7. Data Controller & Your GDPR Rights (EEA/UK Users)

Flashsoft, operating out of Estonia, is the data controller for the personal data described in this policy. If you are located in the European Economic Area or the United Kingdom, you additionally have the right, subject to applicable law, to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request erasure of your data (see also §6, Delete Your Account);
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee) or your local supervisory authority.

To exercise any of these rights, contact us using the details in §10.

8. Children's Privacy

StepLeague is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. International Data Transfers

Our service providers may process and store data on servers located outside your country of residence, including in the United States. By using StepLeague, you consent to this transfer, in accordance with this Privacy Policy and applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date above and, where appropriate, through an in-app notice. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

Email: support@flasshsoft.com

This policy is written to satisfy Apple App Store Review Guideline 5.1.1 (Data Collection & Storage) and App Privacy "Nutrition Label" disclosure requirements, including HealthKit's advertising-use restriction (Apple Developer Program License Agreement). It should be reviewed by qualified legal counsel before publication, particularly the governing-law and jurisdiction-specific sections (e.g. GDPR/CCPA rights) for your target markets.